Beetl
Opening your workspace
Getting everything ready
Still working — larger workspaces can take a little longer.
Beetl
Getting everything ready
Still working — larger workspaces can take a little longer.
LEGAL
Draft data processing addendum structure for customer and legal review.
Last updated: 30 July 2026
Draft — legal review required. This page is not an approved customer agreement or legal notice.
The customer is intended to act as controller and Beetl as processor for customer data. Processing is limited to documented customer instructions, the service agreement, and lawful requirements. Final roles and instructions must be confirmed in the signed addendum.
The schedule must identify subject matter, duration, purposes, data categories, data subjects, approved locations, retention periods, and any special-category restrictions for the customer deployment.
Authorised personnel must be bound to confidentiality. The security schedule should attach the verified technical and organisational measures, including access control, tenant isolation, encryption, backup, incident response and secure development evidence.
The approved subprocessor schedule must list the actual production vendors, purpose, location and transfer mechanism. The agreement must define notice, objection and flow-down obligations.
Beetl should assist with data-subject requests, security assessments, impact assessments and regulator consultation to the extent required and proportionate. Request channels, response times and fees require legal approval.
The final agreement must define security-incident notification without undue delay, the initial information available, update cadence, cooperation, preservation of evidence and responsibility for regulator or data-subject notices.
At termination, the customer may request export and deletion subject to the agreed cooling-off period and backup deletion schedule, unless law requires retention.
The parties must agree reasonable assurance evidence and audit terms. Any cross-border transfer mechanism and supplementary measures must match the actual production locations.